Battle24 — Privacy Policy

Effective date: 26 October 2026 · Version: 2.1.0

This Privacy Policy explains how MB Technologijų jėgainė ("we", "us", legal entity code 307171811) collects and processes personal data when you use the Battle24 event-management platform ("Battle24", the "Service"). We act as the sole data controller for platform accounts, security logs, and the long-term sporting results archive. For event registrations and event operations, we and the event's organizer act as joint controllers under GDPR Article 26 as described in section 7.

1. Who we are

MB Technologijų jėgainė (legal entity code 307171811, registered office: Ežero g. 72, Žudiškių k., Riešės sen., LT-14256 Vilniaus r. sav., Republic of Lithuania). Contact for privacy matters and data subject rights: support@demo.battle24.invalid.

2. Data we collect

• Account data: username, email address, hashed password, display name, date of birth (to verify your age and, for under-16s, obtain guardian consent), and optionally crew, country, and bio.
• Participant data (entered by you or by an organizer): dancer name, email, crew, country, nationality (used for national-championship / country eligibility), and — where the event requires them — legal name, phone, and date of birth (date of birth only for age-limited categories).
• Guardian data: for participants under 16, the guardian's name, relationship, and email — used to obtain and verify parental consent (Art. 8).
• Payment data: when an organizer pays for an event, payment is processed by Stripe. We store the tier, amount, currency, and Stripe references — not full card numbers.
• Technical data: IP address, browser/user-agent, session cookies, and security/audit logs of key actions.

3. Why we use it, and our legal basis

• To provide the Service (create accounts, run events, scoring, check-in) — performance of a contract.
• Publishing competition results (your dancer/stage name, scores, brackets) — our legitimate interest in maintaining the public sporting record. You can object at any time and we will anonymise your record.
• Payments — performance of a contract and compliance with legal/accounting obligations.
• Security, fraud prevention, and audit logging — our legitimate interests in keeping the Service safe.
• Transactional email (verification, notifications) — performance of a contract / legitimate interest.
• Terms acceptance and age-eligibility checks — compliance and legitimate interest.

Children

Participants under 16 need a parent or guardian to complete registration and confirm by email, and we make reasonable efforts to verify that consent. We never show children's photos in public galleries without recorded guardian consent, and we anonymise a child's results on request without argument.

4. Cookies and sessions

We use a strictly-necessary session cookie to keep you logged in and to protect against cross-site request forgery. We do not use advertising or third-party tracking cookies.

5. Service providers (processors)

We share data only with providers that help us run the Service, under appropriate agreements:

• Stripe — payment processing.
• Cloudflare — bot protection on forms, delivery of our transactional email, and privacy-friendly website analytics (no cookies, no fingerprinting).
• Hostinger — hosting and backups, located in the EU/EEA.

When an event charges an entry fee by card, you are paying the event organizer, not us: the payment goes to their own Stripe account, and the transaction appears there with the details Stripe records. We take a service fee on top and keep our own record of your entry — the amount, the payment reference and whether it was paid. If you pay an organizer by bank transfer instead, they see the transfer as their bank shows it and tell us it arrived.

We never sell your data, and we never use your contact details for marketing — we send service emails only (such as verification and event notices).

8. International transfers

Our servers and backups (Hostinger) are in the EU/EEA. Stripe and Cloudflare may process some data in the United States under the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses — EU-approved safeguards.

6. How long we keep data

We keep data only as long as we need it: your account for 2 years after your last login (we warn you first); unverified accounts for 30 days; event-registration details with no linked account for 2 years after the event; competition results indefinitely as the sporting record (anonymised on request); payment records for 10 years as accounting law requires; and security logs with IP addresses removed after 90 days and the logs deleted after 2 years.

Entry fees you pay to an organizer are part of those payment records: we keep the amount, the payment reference, the payment status and the Stripe identifiers for the accounting period even after you delete your account, because accounting law requires it. Free-text notes an organizer wrote about your payment, and the link to the staff member who recorded it, are deleted with the rest of your data.

9. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, to data portability, and to withdraw any consent you have given (without affecting processing before withdrawal). Many of these you can do yourself under Profile → Export / Delete account. You may also lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija). To exercise your rights, contact us at support@demo.battle24.invalid.

7. Event organizers and joint controllership (GDPR Art. 26)

When you register for an event on Battle24 (or when an organizer or studio trainer imports your registration), MB Technologijų jėgainė and the event organizer named on the event page act as joint controllers (GDPR Art. 26) for running that event. Essence of the arrangement: (1) The organizer decides which categories and age limits the event runs, whether legal name or phone number are requested, approves entries, runs check-in, judging, and brackets, and is the independent controller and merchant of record for entry fees paid to their Stripe or bank account; the organizer must delete any exported participant contact lists within 30 days after the event and may never use your contact details for unsolicited marketing. (2) Battle24 provides the platform infrastructure, verifies parental consent for under-16 participants, enforces the automated retention schedule, maintains the public sporting results archive, and serves as your single point of contact for privacy and data-protection rights at support@demo.battle24.invalid (though under GDPR Art. 26(3) you may exercise your rights against either controller).

Organizer Data-Sharing and Joint Controller Agreement

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the version and effective date above.

11. Contact

Questions about this Privacy Policy can be sent to support@demo.battle24.invalid.